I've written a blog post which explains what this vulnerability is, how it works, what the facts and non-facts are: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulner...
It would have been really useful if the upgrade notification had included this level of detail to start with so people could make a much more informed decision about when/if to upgrade, rather than having to dive through bug reports, commits etc just to work out if our apps are vulnerable.